Spring Security - Third Edition

Adding the @PreAuthorize method annotation

Our first design decision will be to augment method security at the business tier by ensuring that a user must be logged in as an ADMIN user before he/she is allowed to access the getEvents() method. This is done with a simple annotation added to the method in the service interface definition, as follows:

    import org.springframework.security.access.prepost.PreAuthorize;    ...    public interface CalendarService {       ...     @PreAuthorize("hasRole('ADMIN')")      List<Event> getEvents();    }

This is all that is required to ensure that anyone invoking our getEvents() method is an administrator. Spring Security will use a runtime Aspect Oriented Programming (AOP) pointcut to execute BeforeAdvice on the method, and throw ...